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DETAILED ACTION 

1. Claims 1-20 are pending in this application. 

Claim Objections 

2. Claims 2-15 are objected to because of the following informalities: 
In claims 2-1 5, "A method" should be "The method". 

In claim 2, "the event" in line 1 should be "an event" 
Appropriate correction is required. 



Claim Rejections - 35 USC § 101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

4. Claims 1 and 16-20 are rejected under 35 U.S.C 101 because claims are 
directed to non-statutory subject matter. Claims 1 and 16-20 do not produce concrete 
and tangible results within the enumerated steps. Claims 1 and 16-20 recite limitation 
"comparing a second behavior with the first behavior" but no indication of what would be 
the results at the completion of the enumerated steps. Appropriate action and/or 
clarification is required. 
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Claim Rejections - 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

6. Claims 1-10, 12-13 and 16-17 are rejected under 35 U:S.C. 102(e) as being 
anticipated by Tajalli et al. (Pub. No.: US 2004/0143749 A1), hereinafter "Tajalli". 

7. As to claim 1 , Tajalli discloses a method of providing security (abstract), 
comprising: accessing a database configured to store operational information 
associated with a process (FIG. 4, [0063], [0064], [0065], [0100]); determining a first 
behavior using the operational information, wherein the first behavior is associated with 
the process ([0066], "...define the permitted behavior of applications running on the 
agents", see also [0044], [0054], [0109], [0127]); monitoring the process ([0053], 
[0063]); and comparing a second behavior with the first behavior, wherein the second 
behavior is attempted by the process ([0133], "unacceptable behavior", see also [0044], 
[0082]). 

8. As to claim 2, Tajalli discloses in the event the second behavior is determined to 
be different from the first behavior, the second behavior is determined to be disallowed 
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([0133], "unacceptable behavior", see also [0044], [0081], [0082]). 

9. As to claim 3, Tajalli discloses wherein the first behavior is one of a plurality of 
behaviors determined using the operational information ([0066], "...define the permitted 
behavior of applications running on the agents", see also [0044], [[0051], 0054], [0109], 
[0127]). 

10. As to claim 4, Tajalli discloses wherein the first behavior is one of a plurality of 
behaviors determined using the operational information ([0066], "...define the permitted 
behavior of applications running on the agents", see also [0044], [0054], [0109], [0127]), 
and in the event the second behavior is determined to be different from the plurality of 
behaviors, the second behavior is determined to be disallowed ([0133], "unacceptable 
behavior", see also [0044], [0081], [0082]). 

11. As to claim 5, Tajalli discloses further comprising determining that the second 
behavior is disallowed ([0133], "unacceptable behavior", see also [0081], "...as 
applications request and use resources, looking for requests or uses that depart from 
the acceptable behavior"). 



12. As to claim 6, Tajalli discloses further comprising determining that the second 
behavior is disallowed and performing a predetermined action ([0133], [0106], [0081]). 
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1 3. As to claim 7, Tajalli disclose further comprising determining that the second 
behavior is disallowed and performing a predetermined action, wherein the 
predetermined action includes preventing the second behavior from succeeding ([0133], 
[0106], [0081]). 

14. As to claim 8, Tajalli discloses further comprising determining that the second 
behavior is disallowed and performing a predetermined action, wherein the 
predetermined action includes generating an event associated with the second behavior 
([0081], [0082], [0106], "log data"). 

1 5. As to claim 9, Tajalli discloses wherein determining the first behavior using the 
operational information is performed when the process is not operating ([0066], [0082]). 

16. As to claim 1 0, Tajalli discloses wherein the operational information includes 
optimization information ([0081], "frequency of access"). 

17. As to claim 12, Tajalli discloses wherein the operational information includes 
optimization information ([0081], "frequency of access"), and wherein the optimization 
information is configured on a per user basis ([0205], "The Profiler 1 102 ca be used by 
users to generate BCDs 305 for their own custom applications"). 
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18. As to claim 13, Tajalli discloses wherein the operational information includes 
component access information ([0020], "...each process set has a corresponding 
behavior control description, and controlling access to system resources by each 
process .."). 

19. As to claim 16, Tajalli discloses a system for providing security (abstract), 
comprising: a processor configured to: access a database configured to store 
operational information associated with a process (FIG. 4, [0063], [0064], [0065], 
[0100]); determine a first behavior using the operational information, wherein the first 
behavior is associated with the process ([0066], "...define the permitted behavior of 
applications running on the agents", see also [0044], [0054], [0109], [0127]); monitor the 
process ([0053], [0063]); and compare a second behavior with the first behavior, 
wherein the second behavior is attempted by the process ([0133], "unacceptable 
behavior", see also [0044], [0082]); and a memory coupled with the processor, 
configured to provide the processor with directions (abstract, Tajalli teaches of including 
a memory coupled with a processor to provide directions by monitoring processes and 
by generating behavior control descriptions for each process). 

20. As to claim 17, it is rejected using the same rationale as for the rejection of claim 
1. 
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Claim Rejections - 35 USC § 103 

21. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

22. Claims 11, 14-15 and 18-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Tajalli in view of Shah et al. (Patent No.: US 6,959,320 B2), 
hereinafter "Shah". 

23. As to claim 19, Tajalli discloses a system for providing security (abstract), 
comprising: a processor configured to: determine a first behavior ([0066], "...define the 
permitted behavior of applications running on the agents", see also [0044], [0054], 
[0109], [0127]); monitor a process, wherein the process is associated with the first 
behavior ([0053], [0063]); and compare a second behavior with the first behavior, 
wherein the second behavior is attempted by the process ([0133], "unacceptable 
behavior", see also [0044], [0082]); and a memory coupled with the processor, 
configured to provide the processor with instructions (abstract, Tajalli teaches of 
including a memory coupled with a processor to provide instructions by monitoring 
processes and by generating behavior control descriptions for each process). 

Tajalli doesn't explicitly disclose wherein the first behavior is associated with a 
prefetch file. However, Shah discloses associating a prefetch file (column 33, lines 10- 
46, see also column 26, lines 30-50). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Tajalli by associating a 
prefetch file as taught by Shah in order to "provide a client-side performance 
optimization system" (Shah). 

24. As to claims 18 and 20, these are rejected using the same rationale as for the 
rejection of claim 19. 

25. As to claim 1 1 , Tajalli discloses wherein the operational information includes 
optimization information ([0081]). Tajalli doesn't explicitly disclose the optimization 
information is used to improve process initialization time. However, Shah discloses to 
improve process initialization time (column 33, lines 10-46, see also column 26, lines 
30-50). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Tajalli by improving process 
initialization time as taught by Shah in order to "provide a client-side performance 
optimization system" (Shah). 

26. As to claims 14 and 15, Tajalli discloses a database (FIG. 4). Tajalli doesn't 
explicitly disclose includes a prefetch file. However, Shah discloses prefetch file (column 
33, lines 10-46, see also column 26, lines 30-50). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Tajalli by including a prefetch 
file as taught by Shah in order to "provide a client-side performance optimization 
system" (Shah). 

Conclusion 

27. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. See accompanying PTO 892. 

Dotan (Pub. No.: US 2002/0147923 A1) disclose method for assigning process 
with trust attributes. 

Munson (Patent No.: US 7,096,499 B2) discloses method for simplifying the 
structure of dynamic execution profiles. 

Sameshima (Pub. No.: US 2002/0147509 A1) discloses a behavior monitoring 
process acquires interaction within particular device or between other devices in system 
for storage in behavior log table. 

Gupta et al. (Patent No.: US 6,553,461 B1) discloses client controlled pre- 
fetching of resources. 

28. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Suman Debnath whose telephone number is 571 270 
1256. The examiner can normally be reached on 8 am to 5 pm. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on 571 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 




SD 




